CVE Feed

    Dashboard / CVE / CVE-2026-90825

    CVE-2026-90825

    A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

    Published:Sep 14, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00161
    CVSS Score:3.3

    Affected Products

    Vendor
    Gpac
    Product
    Gpac

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-109827 (CVSS 2.1) — A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_a…
    CVE-2026-108539 (CVSS 2.1) — A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_cor…
    CVE-2026-108538 (CVSS 2.1) — A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v…
    CVE-2026-103227 (CVSS 5.3) — A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_u…
    CVE-2026-88339 (CVSS 5.5) — A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.…
    CVE-2026-93331 (CVSS 6.9) — A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of…
    CVE-2026-92475 (CVSS 1.9) — A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the f…
    CVE-2026-92474 (CVSS 1.9) — A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of th…
    CVE-2026-92473 (CVSS 1.9) — A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of th…
    CVE-2026-92472 (CVSS 1.9) — A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High